Method and system for program execution integrity measurement
The present disclosure is directed towards methods and systems and methods for measuring the integrity of an operating system's execution and ensuring that the system's code is performing its intended functionality. This includes examining the integrity of the code that the operating system is executing as well as the data that the operating system accesses. Integrity violations can be detected in the dynamic portions of the code being executed.
1. A method for constructing a graph from data representing an integrity measurement of a running computer program, the method comprising the steps of:
decomposing the integrity measurement, using a microprocessor, into a plurality of distinct measurement classes, each measurement class representing a semantically related grouping of measurement variables which have been examined to produce a characterization of an isolated subset of a measurement target's state, the measurement variables identifying portions of a kernel of the computer program that are inspectable; and
connecting to each measurement class, using a microprocessor, a structured representation of the measurement of those measurement variables which contribute to the overall measurement of that class,
wherein the structured representation is hierarchically organized to enable successive levels within the structured representation to provide contextual information to be employed for examining increasingly lower levels of classes until an indicated degree of completeness of examination is attained.
2. The method according to claim 1 , the connecting step comprising the step of deriving the structured representation from the measurement target's in memory associations among the examined variables.
3. A machine for graphing data representing an integrity measurement of a running computer program comprising:
a microprocessor coupled to a memory;
wherein the microprocessor is programmed to construct a graph of the data by:
decomposing the integrity measurement into a plurality of distinct measurement classes, each measurement class representing a semantically related grouping of measurement variables which have been examined to produce a characterization of an isolated subset of the running computer program's state, the measurement variables identifying portions of a kernel of the computer program that are inspectable; and
connecting to each measurement class a structured representation of the measurement of those measurement variables derived from the measurement target's in memory object graph which contribute to the overall measurement of that class,
wherein the structured representation is hierarchically organized to enable successive levels within the structured representation to provide contextual information to be employed for examining increasingly lower levels of classes until an indicated degree of completeness of examination is attained.